Comments (9)
All right, decided I'll go with the first option, use createCipheriv
exclusively and bump major version to 1.0.0
as this will be breaking changes.
Concretely, if You're using encryption, after upgrade to 1.0.0
old session data will become unreadable. Positive side of this approach is cleaner code and security consistency on designated session data.
from connect-memcached.
I'll try to finish everything till the end of this week.
from connect-memcached.
@chrisiona please do so, it'll definitely motivate me for a new minor release :)
from connect-memcached.
I am also noticing this with Node v8.9.4
Taken from nodejs/node 16746
It's in the warning: use
crypto.createCipheriv()
, notcrypto.createCipher()
.
I take it we'll need to patch here:
connect-memcached/lib/connect-memcached.js
Line 202 in 33f19c2
@balor LMK if you'd like a PR
from connect-memcached.
@balor I'll see what I can do.
from connect-memcached.
Any news about this?
from connect-memcached.
Ok, found a little time to work on it.
You get the warning because the default algorithm for crypto is aes-256-ctr
which is in a counter mode (-ctr
) and use of these kind of algorithms together with createCipher
function renders security inefficiency, as the same initialization vector is used every time. To be honest this case shouldn't be possible but somehow node crypto module allowed it and now they're trying to fix broken (cryptographically) code by prompting the warning.
It seems that the reasonable fix is to replace createCipher
with createCipheriv
and generate random iv
each time, but that will render current session data incompatible.
Second option is to do a trick similar to this one, which tries to differentiate corrupted sessions and use old function on them exclusively. I'm not a big fan of such solutions to be honest.
Finally, if you really want to fix the security problem, you want not only to use new function for but completely replace the session store with properly encoded data.
What do you think? Feedback needed :)
from connect-memcached.
Thanks, @balor! Do you have an estimate as to when it'll land in NPM?
from connect-memcached.
As promised, v1.0.0 with changes addressing this issue has been released. Be sure to read the changelog.
from connect-memcached.
Related Issues (18)
- session expire HOT 1
- License missing HOT 1
- Example won't work HOT 8
- Dependency on "connect" HOT 1
- Does your library support SASL? HOT 3
- Support recommended store.touch method HOT 4
- maintenance help HOT 1
- Confirm memcached connection HOT 6
- user logout automatically HOT 2
- No authentication? HOT 2
- how to set prefix HOT 3
- Possible bug in AWS environment HOT 10
- Passing in a existing memcached client ignores the secret option HOT 5
- Store fails on memcached 0.0.8 HOT 2
- Latest test suite HOT 4
- Crypto algorithm HOT 6
- Session cookies issue when upgrading from v1 to v2 HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from connect-memcached.